Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
13/02/2024, 08:44
General
-
Target
2024-02-13_69f1037bfff521d993848d162f429f1c_cryptolocker.exe
-
Size
28KB
-
MD5
69f1037bfff521d993848d162f429f1c
-
SHA1
0b9d6c68671b6bffc5816dd828b0fc973def6622
-
SHA256
88c42345087d618b6593cbf83bd6fae838bf03a2c7d1ca20bdd6fad6940b5c69
-
SHA512
fe1f558bf6242fff0509a19779ee69b3a157bf36ce460b07a9fff2af305e2ca109609467d085685171c53ec6e8d2090f900686419ab6da2fcce06382bb141878
-
SSDEEP
768:q0ZziOWwULueOSdE8tOOtEvwDpjeWaJIOc+pp:q0zizzOSxMOtEvwDpj/arR
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_69f1037bfff521d993848d162f429f1c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_69f1037bfff521d993848d162f429f1c_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD52be68c01f6c6d58ae010a0fba90cb92b
SHA1d84c4f5685c4c8d9d99dcdeabd577088163b2d0e
SHA25639ca6d84f81a72ec1f84e1467a502086b249c3d76e0b8f0c40ef0ef312e43ec7
SHA512a8b320ae3350caf07a6397f4df77c7d299ae85787e5681479612133ac24df8a149a3e18302e90f83e43e39ef75ec7d8e69933caff993e6777a05928205f2c0d5
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB